Hacking Articles Tips Tricks Videos Tutorials
Black Hat Ethical Hacking Researcher bypass email filter – XSS in Gmail’s AMP For Email Researcher bypass email filter – XSS in Gmail’s AMP For EmailPost Views: 54 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Patreon-1.png…
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Images-for-the-News-posts-2-300x150.png New Linux malware called RapperBot brute-forces Linux SSH servers to breach networksAugust 5, 2022
Reading Time: 4 minutes
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Images-for-the-News-posts-1-300x150.png Jenkins security: Unpatched XSS, CSRF bugs included in latest plugin advisoryAugust 4, 2022
Reading Time: 3 minutes
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Images-for-the-News-posts-300x150.png VMware urges admins to patch critical auth bypass bug immediatelyAugust 3, 2022
Reading Time: 3 minutes
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post Researcher bypass email filter – XSS in Gmail’s AMP For Email first appeared on Black Hat Ethical Hacking.
Reading Time: 4 minutes
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Images-for-the-News-posts-1-300x150.png Jenkins security: Unpatched XSS, CSRF bugs included in latest plugin advisoryAugust 4, 2022
Reading Time: 3 minutes
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Images-for-the-News-posts-300x150.png VMware urges admins to patch critical auth bypass bug immediatelyAugust 3, 2022
Reading Time: 3 minutes
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post Researcher bypass email filter – XSS in Gmail’s AMP For Email first appeared on Black Hat Ethical Hacking.
Zero to Hero Malware Reverse Engineering & Threat Intelligence
https://www.reddit.com/r/redteamsec/comments/wjyjh0/zero_to_hero_malware_reverse_engineering_threat/
submitted by /u/cybersocdm (https://www.reddit.com/user/cybersocdm)
[link] (https://www.reddit.com/r/cybersocitlibrary/comments/wjyfpf/zero_to_hero_malware_reverse_engineering_threat/) [comments] (https://www.reddit.com/r/redteamsec/comments/wjyjh0/zero_to_hero_malware_reverse_engineering_threat/)
https://www.reddit.com/r/redteamsec/comments/wjyjh0/zero_to_hero_malware_reverse_engineering_threat/
submitted by /u/cybersocdm (https://www.reddit.com/user/cybersocdm)
[link] (https://www.reddit.com/r/cybersocitlibrary/comments/wjyfpf/zero_to_hero_malware_reverse_engineering_threat/) [comments] (https://www.reddit.com/r/redteamsec/comments/wjyjh0/zero_to_hero_malware_reverse_engineering_threat/)
Pentester Promiscuous Notebook
https://medium.com/@reconshell.com/pentester-promiscuous-notebook-a230d880a924?source=rss------bug_bounty-5
https://medium.com/@reconshell.com/pentester-promiscuous-notebook-a230d880a924?source=rss------bug_bounty-5
gitbook for keeping my pentest notes on hand. It’s far from being perfect in terms
of organization (that’s why I call it “promiscuous”)…Continue reading on Medium » (https://medium.com/@reconshell.com/pentester-promiscuous-notebook-a230d880a924?source=rss------bug_bounty-5)
of organization (that’s why I call it “promiscuous”)…Continue reading on Medium » (https://medium.com/@reconshell.com/pentester-promiscuous-notebook-a230d880a924?source=rss------bug_bounty-5)
TOP Cross-Chain Bridge Open Test Is Underway
https://medium.com/top-network/top-cross-chain-bridge-open-test-is-underway-ecbfa224d9b7?source=rss------bug_bounty-5
https://medium.com/top-network/top-cross-chain-bridge-open-test-is-underway-ecbfa224d9b7?source=rss------bug_bounty-5
Since the emergence of DeFi, the congestion and high GAS fees of the Ethereum has hit heated discussions and led to the emergence of many…Continue reading on TOP Network » (https://medium.com/top-network/top-cross-chain-bridge-open-test-is-underway-ecbfa224d9b7?source=rss------bug_bounty-5)
Everything you need to know about starting a career in bug bounty hunting
IntroductionContinue reading on Medium »
Read more...
IntroductionContinue reading on Medium »
Read more...
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Collider from BlackCat — a working platform for selecting a private key for bitcoin wallets
https://cdn-images-1.medium.com/max/660/0*hACPwgt-MKBbkF5g.jpg
Mathematicians claim that it is almost impossible to find a private key, because finding one specific address is 2²⁵⁶ degrees…
Continue reading on Medium »
Collider from BlackCat — a working platform for selecting a private key for bitcoin wallets
https://cdn-images-1.medium.com/max/660/0*hACPwgt-MKBbkF5g.jpg
Mathematicians claim that it is almost impossible to find a private key, because finding one specific address is 2²⁵⁶ degrees…
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Pentester Promiscuous Notebook
https://cdn-images-1.medium.com/max/642/1*psu6XMaWk9fI_vGJihkd5w.jpeg
gitbook for keeping my pentest notes on hand. It’s far from being perfect in terms
of organization (that’s why I call it “promiscuous”)…
Continue reading on Medium »
Pentester Promiscuous Notebook
https://cdn-images-1.medium.com/max/642/1*psu6XMaWk9fI_vGJihkd5w.jpeg
gitbook for keeping my pentest notes on hand. It’s far from being perfect in terms
of organization (that’s why I call it “promiscuous”)…
Continue reading on Medium »
Everything you need to know about starting a career in bug bounty hunting
https://medium.com/@capturethebugs/everything-you-need-to-know-about-starting-a-career-in-bug-bounty-hunting-d21f4eb72cd2?source=rss------bug_bounty-5
https://medium.com/@capturethebugs/everything-you-need-to-know-about-starting-a-career-in-bug-bounty-hunting-d21f4eb72cd2?source=rss------bug_bounty-5
IntroductionContinue reading on Medium » (https://medium.com/@capturethebugs/everything-you-need-to-know-about-starting-a-career-in-bug-bounty-hunting-d21f4eb72cd2?source=rss------bug_bounty-5)
Hacking Articles Tips Tricks Videos Tutorials
Photo
Black Hat Ethical Hacking
Twilio discloses data breach after SMS phishing attack on employees
Twilio discloses data breach after SMS phishing attack on employeesPost Views: 20 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Patreon-1.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes Cloud communications company Twilio says some of its customers’ data was accessed by attackers who breached internal systems after stealing employee credentials in an SMS phishing attack.“On August 4, 2022, Twilio became aware of unauthorized access to information related to a limited number of Twilio customer accounts through a sophisticated social engineering attack designed to steal employee credentials,” Twilio said over the weekend.
“The attackers then used the stolen credentials to gain access to some of our internal systems, where they were able to access certain customer data.”
The company also revealed the attackers gained access to its systems after tricking and stealing credentials from multiple employees targeted in the phishing incident.
To do that, they impersonated Twilio’s IT department, asking them to click URLs containing “Twilio,” “Okta,” and “SSO” keywords that would redirect them to a Twilio sign-in page clone.
The SMS phishing messages baited Twilio’s employees into clicking the embedded links by warning them that their passwords had expired or were scheduled to be changed.
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course
Twilio’s EMEA Communications Director Katherine James declined to provide more information when asked how many employees had their accounts compromised in the phishing attack and how many customers were affected by the breach, saying the company has “no additional comment to provide at this time beyond what is posted in the blog.”
https://www.bleepstatic.com/images/news/u/1109292/2022/Twilio_phishing_SMS.png
<figcaptionTwilio SMS phishing message (Twilio)
“The text messages originated from U.S. carrier networks. We worked with the U.S. carriers to shut down the actors and worked with the hosting providers serving the malicious URLs to shut those accounts down,” Twilio added.
“We have heard from other companies that they, too, were subject to similar attacks, and have coordinated our response to the threat actors – including collaborating with carriers to stop the malicious messages, as well as their registrars and hosting providers to shut down the malicious URLs. Despite this response, the threat actors have continued to rotate through carriers and hosting providers to resume their attacks.”
Trending: Find Hidden Info using Google Dorking manually, and Automated using Pagodo
Trending: Offensive Security Tool: Offensive-Azure Credentials revoked, attackers yet to be identifiedThe company has not yet identified the attackers, but it’s working with law enforcement as part of an ongoing investigation.
Twilio revoked the employee accounts compromised during the attack to block the attackers’ access to its systems and has started notifying customers affected by this incident.
“As the threat actors were able to access a limited number of accounts’ data, we have been notifying the affected customers on an individual basis with the details,” Twilio also revealed.
The company also disclosed in May 2021 that it was impacted by last year’s Codecov supply-chain attack where threat actors modified the legitimate Codecov Bash Uploader tool to steal credentials, secret keys, and user tokens from Codecov customers.
With more than 5,000 employees in 26 offices in 17 countries, Twillio provides programmable voice, text, chat, video, and email APIs used by over 10 mi[...]
Twilio discloses data breach after SMS phishing attack on employees
Twilio discloses data breach after SMS phishing attack on employeesPost Views: 20 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Patreon-1.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes Cloud communications company Twilio says some of its customers’ data was accessed by attackers who breached internal systems after stealing employee credentials in an SMS phishing attack.“On August 4, 2022, Twilio became aware of unauthorized access to information related to a limited number of Twilio customer accounts through a sophisticated social engineering attack designed to steal employee credentials,” Twilio said over the weekend.
“The attackers then used the stolen credentials to gain access to some of our internal systems, where they were able to access certain customer data.”
The company also revealed the attackers gained access to its systems after tricking and stealing credentials from multiple employees targeted in the phishing incident.
To do that, they impersonated Twilio’s IT department, asking them to click URLs containing “Twilio,” “Okta,” and “SSO” keywords that would redirect them to a Twilio sign-in page clone.
The SMS phishing messages baited Twilio’s employees into clicking the embedded links by warning them that their passwords had expired or were scheduled to be changed.
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course
Twilio’s EMEA Communications Director Katherine James declined to provide more information when asked how many employees had their accounts compromised in the phishing attack and how many customers were affected by the breach, saying the company has “no additional comment to provide at this time beyond what is posted in the blog.”
https://www.bleepstatic.com/images/news/u/1109292/2022/Twilio_phishing_SMS.png
<figcaptionTwilio SMS phishing message (Twilio)
“The text messages originated from U.S. carrier networks. We worked with the U.S. carriers to shut down the actors and worked with the hosting providers serving the malicious URLs to shut those accounts down,” Twilio added.
“We have heard from other companies that they, too, were subject to similar attacks, and have coordinated our response to the threat actors – including collaborating with carriers to stop the malicious messages, as well as their registrars and hosting providers to shut down the malicious URLs. Despite this response, the threat actors have continued to rotate through carriers and hosting providers to resume their attacks.”
Trending: Find Hidden Info using Google Dorking manually, and Automated using Pagodo
Trending: Offensive Security Tool: Offensive-Azure Credentials revoked, attackers yet to be identifiedThe company has not yet identified the attackers, but it’s working with law enforcement as part of an ongoing investigation.
Twilio revoked the employee accounts compromised during the attack to block the attackers’ access to its systems and has started notifying customers affected by this incident.
“As the threat actors were able to access a limited number of accounts’ data, we have been notifying the affected customers on an individual basis with the details,” Twilio also revealed.
The company also disclosed in May 2021 that it was impacted by last year’s Codecov supply-chain attack where threat actors modified the legitimate Codecov Bash Uploader tool to steal credentials, secret keys, and user tokens from Codecov customers.
With more than 5,000 employees in 26 offices in 17 countries, Twillio provides programmable voice, text, chat, video, and email APIs used by over 10 mi[...]
Hacking Articles Tips Tricks Videos Tutorials
Black Hat Ethical Hacking Twilio discloses data breach after SMS phishing attack on employees Twilio discloses data breach after SMS phishing attack on employeesPost Views: 20 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Patreon…
llion developers and 150,000 businesses to build customer engagement platforms.
Twilio also acquired Authy in February 2015, a popular two-factor authentication (2FA) provider for end users, developers, and enterprises with millions of users worldwide.
Trending: New Linux malware called RapperBot brute-forces Linux SSH servers to breach networks
Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?
If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
Source: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Images-for-the-News-posts-5-300x150.png Researcher bypass email filter – XSS in Gmail’s AMP For EmailAugust 9, 2022
Reading Time: 3 minutes
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Images-for-the-News-posts-3-1-300x150.png Twitter confirms zero-day used to expose data of 5.4 million accountsAugust 8, 2022
Reading Time: 4 minutes
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Images-for-the-News-posts-2-300x150.png New Linux malware called RapperBot brute-forces Linux SSH servers to breach networksAugust 5, 2022
Reading Time: 4 minutes
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Images-for-the-News-posts-1-300x150.png Jenkins security: Unpatched XSS, CSRF bugs included in latest plugin advisoryAugust 4, 2022
Reading Time: 3 minutes
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post Twilio discloses data breach after SMS phishing attack on employees first appeared on Black Hat Ethical Hacking.
Twilio also acquired Authy in February 2015, a popular two-factor authentication (2FA) provider for end users, developers, and enterprises with millions of users worldwide.
Trending: New Linux malware called RapperBot brute-forces Linux SSH servers to breach networks
Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?
If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
Source: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Images-for-the-News-posts-5-300x150.png Researcher bypass email filter – XSS in Gmail’s AMP For EmailAugust 9, 2022
Reading Time: 3 minutes
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Images-for-the-News-posts-3-1-300x150.png Twitter confirms zero-day used to expose data of 5.4 million accountsAugust 8, 2022
Reading Time: 4 minutes
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Images-for-the-News-posts-2-300x150.png New Linux malware called RapperBot brute-forces Linux SSH servers to breach networksAugust 5, 2022
Reading Time: 4 minutes
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Images-for-the-News-posts-1-300x150.png Jenkins security: Unpatched XSS, CSRF bugs included in latest plugin advisoryAugust 4, 2022
Reading Time: 3 minutes
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post Twilio discloses data breach after SMS phishing attack on employees first appeared on Black Hat Ethical Hacking.